Most browsers enforce a cross-domain security restriction. This means your javascript code can only access the server from which the javascript has been loaded. As geonames.org is a different server you cannot directly call the geonames webservice using XMLHttpRequest.